CH4 — Ghost Session — TelcoBreak CTF

1

What Is the Open5GS WebUI?

The operator management dashboard — and what ships by default

Open5GS ships a WebUI management dashboard on port 3000. Operators use it to provision subscriber SIM cards, manage accounts, view network status, and configure the core. It is backed by MongoDB and exposes a REST API. The dashboard is the administrative control plane for the entire 5G core.

The WebUI ships with a hardcoded default administrator account: username admin, password 1423. This is documented in the Open5GS source code and has been the default since the project launched. In this lab, those credentials have never been changed. A planted operator account in MongoDB has the flag in its note field — and the IDOR means you do not even need admin privileges to read it.

This is not a vulnerability we invented. Open5GS ships default credentials because it is intended for development and lab use. The problem is operators deploying it in production without changing them. This challenge demonstrates exactly that failure mode — and shows how a second vulnerability (IDOR) compounds the first.

2

Two Vulnerabilities

Default credentials AND insecure direct object reference

This challenge combines two distinct security failures that are each bad on their own — and catastrophic together. Understanding both is the point of the exercise.

Combined Vulnerability Chain

Default Creds + IDOR = Full Account Disclosure

01

Default Credentials

admin / 1423 ships in source code and has never been rotated. Any attacker who knows the software can log in immediately.

02

IDOR — No Per-Record Auth

Once logged in as any user, the API returns any account record by ID with no ownership check. Non-admin users can read admin data.

🔒

Hardened OAM Interface

Production deployment baseline

Default creds changedYes — first boot required

OAM accessVPN / management network only

Account record accessPer-record authorization

MongoDB exposureInternal only, auth required

Note field contentsInternal ops data, gated

🔓

Your Lab (Open5GS)

Default config — nothing rotated

Default creds changedNo — admin / 1423

OAM accessPort 3000 on SBI network

Account record accessNo ownership check (IDOR)

MongoDB exposureReachable via docker exec

Note field contentsFlag in ctf-ops- account

3

The Attack

Two paths — browser WebUI or direct MongoDB query

This challenge has two equally valid attack paths. Both reach the same planted account. The direct MongoDB path is faster and does not require a browser. The WebUI path demonstrates the IDOR more clearly and is how a real attacker with only HTTP access would proceed.

Path A

Browser — WebUI Login

Navigate to http://10.100.200.200:3000 in a browser. Log in with admin / 1423. Browse to the accounts list — every operator account is visible. Find the account whose username starts with ctf-ops- and read its note field. This is the IDOR in action: you logged in as admin, but the vulnerability also exists for non-admin users.

Path B — Recommended

Direct — MongoDB Query

Skip the browser entirely. Query MongoDB directly via docker exec. This exposes the raw database layer that the WebUI sits in front of. The mongosh command below finds every account with a non-empty note field — the planted ctf-ops- account will appear with the flag in its note.

1

Connect to MongoDB via docker exec

The moriah-mongodb container runs MongoDB with admin credentials admin:moriah123. You access it via docker exec from any host with Docker access to the core environment.

2

Query the accounts collection for note fields

The WebUI stores operator accounts in the open5gs database, accounts collection. Query all accounts and filter for those with a non-empty note field. The planted ctf-ops- account will appear with the flag.

Path B — Direct MongoDB Query (Recommended)sudo docker exec moriah-mongodb mongosh \
  "mongodb://admin:moriah123@10.100.200.10:27017/open5gs?authSource=admin" \
  --quiet \
  --eval "db.accounts.find({},{username:1,note:1}).forEach(function(a){if(a.note)print(a.username+' -> '+a.note)})"

# Look for the line: ctf-ops-<suffix> -> TWIN{...}
# The note field IS the flag

Expected Output — flag highlighted

admin -> (no note)
ctf-ops-xxxxxxxx -> TWIN{xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx}   <-- THIS IS THE FLAG

Browser alternative: If you prefer the visual path, open http://10.100.200.200:3000 in a browser, log in with admin / 1423, and navigate to the subscriber/accounts section. Find the ctf-ops- account and view its details — the note field contains the flag. The direct MongoDB path above is faster and requires no browser on your WireGuard client.

4

Real World Impact

Default credentials and IDOR in production OAM interfaces

Default credentials on management interfaces are one of the most extensively documented attack classes in telecommunications. Every major GSMA security advisory addresses them. They persist because operators treat lab-hardened software as production-ready without the hardening step.

🔐
OAM access equals full core control The Operations, Administration, and Maintenance interface is the highest-privilege plane in a 5G core. An attacker who logs into the WebUI as admin can provision new SIM cards, delete subscriber records, modify authentication keys, and reconfigure network functions — all through the same dashboard that legitimate operators use.
🏊
IDOR enables privilege escalation without privilege The IDOR vulnerability means an attacker does not need admin credentials — any valid account will do. If a lower-privileged helpdesk account is compromised, the IDOR allows reading every other account's data, including admin accounts and their internal notes. One credential becomes all credentials.
💻
Vendor-documented defaults are public knowledge Default credentials are not secrets. They appear in product documentation, GitHub repositories, public forums, and CVE databases. An attacker targeting a specific 5G core vendor has a list of known defaults to try before attempting any brute force. Open5GS's admin/1423 is in its README.
📋
Internal notes expose operational intelligence The note field exploited in this challenge mirrors a real pattern: operators store internal operational data — network segments, credentials for other systems, incident notes, customer information — in fields not intended for external access. IDOR makes all of it readable by any authenticated user.

MITRE FiGHT FGT5004 — Default Credentials on OAM Interface: This technique specifically calls out that 5G core management interfaces often ship with default or weak credentials, and that OAM interfaces have elevated access to the core that makes credential compromise particularly damaging. The IDOR compound vulnerability is not in the FiGHT technique but is documented in OWASP API Security Top 10 (API1).

5

Flag Format

Where to look and what to submit

CH4 Flag Format

TWIN{xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx}

32 lowercase hexadecimal characters inside the braces.

The flag is in the note field of the MongoDB account whose username begins with ctf-ops-. Access it via the direct MongoDB query shown above, or by browsing to the WebUI at http://10.100.200.200:3000 with credentials admin / 1423.

The note field contains the complete TWIN{...} string — copy it exactly as shown and submit.

Submission tip: The flag in the note field is already in TWIN{...} format — submit it exactly as it appears. The 32-character hex string inside the braces is the value to watch for. If the note field is empty or missing, you may be querying the wrong database or the wrong collection.